Malware replaced the BTC address on the clipboard with the attacker's address just before the user pasted it.

Clipboard hijacking is effective because the swap happens invisibly while the user believes they are sending to the correct address.